Completes Api::PaymentsController

* Can create and update payments accordingly,
* Checks permissions to create and update payment records.